The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent to fetch its core methodology, phase definitions, and API catalogs from an untrusted third-party GitHub repository.
Evidence: In references/full-catalog.md, the skill explicitly points to https://github.com/Socialpranker/claude-deep-research as the source for 'phases.yaml' (canonical phase definitions), 'references/api_sources/', and 'references/blocks/'. It directs the agent to 'pull the upstream catalog' for the full sourcing surface.
Risk: Loading operational logic and API configurations from an unverified external source allows the repository owner to modify the agent's behavior, instructions, or target endpoints without the user's knowledge or a change to the local skill files.
[INDIRECT_PROMPT_INJECTION]: The skill's architecture is built around fetching and processing large amounts of untrusted data from the open web, which is a primary vector for indirect prompt injection.
Ingestion points: The pipeline described in SKILL.md involves fetching content from '29 search channels' and '39 validated APIs'.
Boundary markers: There are no explicit instructions or formatting requirements (such as XML tags or clear delimiters) provided to the agent to help it distinguish between its own system instructions and potentially malicious instructions embedded in retrieved search results.
Capability inventory: The skill possesses significant capabilities, including extensive network access for searching and the ability to write multiple files to the local file system (e.g., sources/, findings/, plan.md).
Sanitization: The methodology focuses on 'triangulation' for factual accuracy but lacks any explicit technical sanitization or safety checks to prevent retrieved data from influencing the agent's instructional context.

deep-research